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Approved: 

/'"Matthew LarocSe / Nicholas Lewin / 
Assistant United States Attorneys 

Before: THE HONORABLE HENRY PITMAN 

United States Magistrate Judge 
Southern District of New York 



UNITED STATES OF AMERICA 


X 


SEALED COMPLAI1 


f •; Til 


- V. - 


JOSHUA ADAM SCHULTE, 


Defendant 


" ' ' .. '1 * > 

w *«* f : _ 

Violations of 
18 U.S.C. §§ 

2252A(a) (2) (B) , (a) (5) (B) 

(a) (1) , (b) (1) , (b) (2) , 

and 2 

COUNTY OF OFFENSE: 

NEW YORK 


X 


STATE OF NEW YORK ) 

COUNTY OF NEW YORK : SS.: 

SOUTHERN DISTRICT OF NEW YORK ) 


Jeff David Donaldson, being duly sworn, deposes and 
says that he is a Special Agent with the Federal Bureau of 
Investigation ("FBI"), and charges as follows: 

COUNT ONE 

(Receipt of Child Pornography) 

1. From at least in or about 2009, up to and including at 
least in or about March 2017, in the Southern District of New 
York and elsewhere, JOSHUA ADAM SCHULTE, the defendant, 
knowingly did receive and attempt to receive material that 
contains child pornography that had been mailed, and using a 
means and facility of interstate and foreign commerce shipped 
and transported in and affecting interstate and foreign commerce 
by any means, including by computer, to wit, SCHULTE downloaded 
from the Internet electronic files depicting child pornography. 

(Title 18, United States Code, Sections 2252A(a)(2)(B), (b)(1) 

and 2.) 
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COUNT TWO 

(Possession of Child Pornography) 

2. From at least in or about 2009, up to and including at 
least in or about March 2017, in the Southern District of New 
York and elsewhere, JOSHUA ADAM SCHULTE, the defendant, 
knowingly did possess and access with intent to view, and 
attempt to possess and access with intent to view, a book, 
magazine, periodical, film, videotape, computer disk, and other 
material that contained an image of child pornography that had 
been mailed, shipped and transported using a means and facility 
of interstate and foreign commerce and in and affecting 
interstate and foreign commerce by any means, including by 
computer, and that was produced using materials that had been 
mailed, shipped and transported in and affecting interstate and 
foreign commerce by any means, including by computer, to wit, 
SCHULTE accessed with intent to view and possessed images and 
videos of child pornography at his residence in New York, New 
York. 

(Title 18, United States Code, Sections 2252A(a)(5)(B), (b)(2) 

and 2.) 

COUNT THREE 

(Transportation of Child Pornography) 

3. In or about November 2016, in the Southern District of 
New York and elsewhere, JOSHUA ADAM SCHULTE, the defendant, 
knowingly did mail and transport and ship using a means and 
facility of interstate and foreign commerce and in and affecting 
interstate and foreign commerce by any means, including by 
computer, child pornography, to wit, SCHULTE transported from 
Virginia to New York, New York, a computer containing images and 
videos of child pornography. 

(Title 18, United States Code, Section 2252A(a)(1).) 

The bases for my knowledge and the foregoing charges 
are, in part, as follows: 

1. I am a Special Agent with the FBI, and I have 
been personally involved in the investigation of this matter. 
This affidavit is based in part upon my conversations with law 
enforcement agents and other people, and my examination of 
reports and records. Because this affidavit is being submitted 
for the limited purpose of establishing probable cause, it does 
not include all of the facts that I have learned during the 
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course of my investigation. Where the contents of documents and 
the actions, statements, and conversations of others are 
reported herein, they are reported in substance and in part, 
except where otherwise indicated. 

2. I know, based on my conversations with other law 
enforcement agents and other people, my participation in this 
investigation, my review of documents, and my training and 
experience, that: 

a. On or about March 13, 2017, the Honorable 
Barbara C. Moses, a U.S. Magistrate Judge for the Southern 
District of New York, issued a search warrant (the "Schulte 
Search Warrant") to search the residence of JOSHUA ADAM SCHULTE, 
the defendant, in New York, New York (the "Residence"). 

b. On or about March 15, 2017, members of the 
FBI searched the Residence. During the course of that search, 
law enforcement officers recovered, among other things, multiple 
computers, servers, and other portable electronic storage 
devices (the "Subject Devices"), including SCHULTE'S personal 
desktop computer (the "Desktop Computer"). 

3. I know, based on my conversations with FBI agents 
including agents assigned to the Crimes Against Children Squad 
(the "CACS Agents"), my review of documents, and my training and 
experience, the following: 

a. During the course of reviewing the Desktop 
Computer, CACS agents encountered a volume of files in an 
encrypted container, approximately 54 GB in size (the "Encrypted 
Container") . 1 


b. As described in more detail below, law 
enforcement personnel were able to defeat the encryption used to 
protect the Encrypted Container by entering passwords recovered 
from a cellular telephone belonging to JOSHUA ADAM SCHULTE, the 
defendant. 


1 I understand, based on my conversations with computer 
scientists involved in this investigation, my training and 
experience, and my involvement in this investigation, that a 
"container" in this context refers generally to a data structure 
that holds one or more different types of data. 
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c. The Encrypted Container contains over ten 
thousand files, including images and videos, that appear 
consistent with child pornography (the "CP Files"). 

d. The CP Files are organized in folders, some 
of which are titled "downloads," "new," "kids," "old," "other," 
and "young." In addition, within the "downloads" folder, there 
are additional subfolders titled "13yo in bath" and "llyr old" 
that also contain child pornography. 

e. A sample of the CP Files is listed below, 
along with summary descriptions: 

i. "Jenny 9yo daughter - Full.mpg" is a 
video, approximately seventeen minutes long, found in a folder 
titled "downloads." The video depicts an approximately eight- 
to-ten-year-old prepubescent female engaged in sexual acts. For 
example, during part of the video, the prepubescent female's 
shins are tied to her thighs with a yellow rope, and a male hand 
then masturbates the prepubescent female's vagina. During 
another part of the video, the prepubescent female engages in 
oral sex on an adult male penis. 

ii. "(Lolita)!Pthc - 2010 (Toddlergirl) 

Kait 5yo Willing-Ffk-Sk-Fcs.avi" is a video, approximately three 
minutes and twenty-three seconds long, found in a folder titled 
"downloads." The video depicts a prepubescent female 
approximately three-to-six years old engaging in various sex 
acts. For example, at one point in the video, the prepubescent 
female has her legs spread in a lewd and lascivious manner, and 
she touches her vagina while an adult male touches her 
vagina. The adult male then penetrates the prepubescent 
female's vagina with his index finger. 

iii . "PTHC- beauty-cumshot 3yo THIS ROCKS 
pedo child toddler incest2yo 4yo 5yo 6yo 7yo 8yo babyj vicky 
laura jenny sofie fdsa hussyfan Russian korea.mpg" is a video, 
approximately six minutes and thirty-seven seconds long, found 
in a folder titled "new." The video depicts a female toddler 
that appears to be between the ages of two and four years old 
engaging in sexual acts. For example, at one point in the 
video, the toddler's legs are spread and her vagina shown in a 
lewd and lascivious manner. Later, an adult male masturbates 
his penis, rubs the toddler's vagina, and holds one of her legs 
open. The toddler later grabs the adult male penis. 
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iv. "(PTHC Lolifuck) lOYo Katrina - 
Doggystyle (New 2008).avi" is a video, approximately six minutes 
and eighteen seconds long, found in a folder titled "new." The 
video depicts a prepubescent female who appears to be between 
nine and eleven years old engaging in sexual acts. For example, 
the video begins with the prepubescent female washing her vagina 
over what appears to be a pot of water and masturbating. Later, 
an adult male inserts his finger into the prepubescent female's 
anus and another finger rubs the prepubescent female's vagina. 

f. Within the Encrypted Container, the CACS 
Agents also identified documents that contained links to 
numerous illicit websites (the "Websites"). Based on the CACS 
Agents' training, experience, and familiarity with the Websites, 
they believe that some of the Websites have been used to access, 
view, and download child pornography, as well as other types of 
pornography. Based on a forensic review of the Desktop 
Computer, some of the Websites known to contain child 
pornography appear to have been accessed by the user of the 
Desktop Computer. 

4. I know, based on my conversations with other law 
enforcement agents, including FBI computer scientists involved 
in a forensic review of the Subject Devices (the "Computer 
Scientists"), that the CP Files reviewed by the CACS Agents were 
discovered by the Computer Scientists in the Encrypted Container 
on the Desktop Computer. Specifically: 

a. During the examination of the Desktop 
Computer, the Computer Scientists determined that an encrypted 
virtual machine was present on the Desktop Computer (the "VM"). 

A virtual machine allows a user to create a separate computer 
operating system within a physical computer's operating system. 
The Computer Scientists were able to access the VM by inputting 
a password obtained from a forensic examination of a cellphone 
(the "Cellphone") belonging to JOSHUA ADAM SCHULTE, the 
defendant (the "Cellphone Examination"). 2 Specifically, the 
Cellphone Examination identified various passwords that had been 
input by the user of the Cellphone to, for example, access the 
phone, applications on the phone, and/or certain websites. 

b. Upon accessing the VM, the Computer 
Scientists identified a user account "Josh" with an encrypted 
home directory (the "Home Directory"). The Computer Scientists 


2 On or about March 20, 2017, JOSHUA ADAM SCHULTE, the defendant, 

consented to the search of his Cellphone. 
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were able to access the Home Directory by inputting a different 
password obtained from the Cellphone Examination of SCHULTE'S 
Cellphone. 


c. Upon accessing the Home Directory, the 
Computer Scientists identified a file titled "data.bkp" that was 
approximately 50 gigabytes in size (the "Data File"). 

Initially, when the Computer Scientists opened the Data File, 
the file appeared to contain only random, binary data. In 
addition, the Computer Scientists determined that an encryption 
software called VeraCrypt was installed on the VM. VeraCrypt 
allows users to create encrypted, password protected containers 
(e.g., zip files) on their computers. 

d. Based on the size of the Data File and its 
contents, which appeared to be highly random data, and based on 
the presence of VeraCrypt on the VM, the Computer Scientists 
determined that the Data File was potentially a VeraCrypt 
encrypted container. The Computer Scientists were subsequently 
able to decrypt the Data File using VeraCrypt Software by 
entering the same password used to access the VM. As described 
above, that password was obtained from the Cellphone Examination 
of SCHULTE's Cellphone. Once the Data File was decrypted, the 
Encrypted Container was accessible, and the CP Files were 
discovered within that container. 

e. In addition, within the Encrypted Container, 
there was an additional file also titled "data.bkp" that was 
several gigabytes in size and that also contained random, binary 
data (the "Second Data File"). The Computer Scientists were 
subsequently able to decrypt the Second Data File using 
VeraCrypt Software by entering the same password used to access 
the VM and the Data File, as described above. Once the Second 
Data File was decrypted, it contained forensic artifacts of 
files having names indicative of child pornography. 

5. I know, based on my conversation with the 
Computer Scientists, my review of documents, and my training and 
experience, that during their review of the Desktop Computer, 
the Computer Scientists discovered the Internet Relay Chat 
program (the "IRC Program") on it. The IRC Program is a 
computer application that allows users to communicate with other 
individuals and groups in a chatroom. I also know, based on my 
conversation with the Computer Scientists, my review of 
documents, and my training and experience, that the IRC Program 
on the Desktop Computer stored conversations between JOSHUA ADAM 
SCHULTE, the defendant - who, as explained below, communicated 
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using a username "Josh" - and other individuals. During those 
IRC Program chats, SCHULTE and others appear to discuss, among 
other things, their receipt and distribution of child 
pornography (the "Chats"). For example: 

a. On or about January 8, 2009, SCHULTE, using 
username "Josh" communicated with an individual using the 
username "Sturm." During that conversation, Sturm asked SCHULTE 
"what's your email address" to which SCHULTE responded by 
providing an email address (the "Schulte Email Address"). I 
know, based on my discussions with individuals who know SCHULTE 
and are familiar with his use of electronic communications, that 
the Schulte Email Address, which includes SCHULTE'S name, is 
used by SCHULTE. 

b. On or about January 17, 2009, SCHULTE, using 
username "Josh" communicated with username "Sturm." During that 
conversation, SCHULTE and Sturm appeared to discuss where to 
store child pornography on their computers to avoid detection. 
Specifically, the following exchange occurred, in substance and 
in part: 3 


SCHULTE: You can use it [an encrypted location] to 

store data as well, backup data or w/e . . 

it's encrypted, raided, and you can be sure 
of privacy. 

Sturm: A great place for kiddy porn! 

[....] 

SCHULTE: lol . . . 


Sturm: 
SCHULTE: 
Sturm: 
SCHULTE: 
Sturm: 


Or normal porn. Or backups. 

I guess if that's what gets you off. . 
Backups? "This tarball sure is hot. . 
lol. I meant kiddy porn, 
oh. yeah. 


3 The portions of the Chats included in paragraph 5 were copied 
verbatim and not corrected for typographical errors. 
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SCHULTE: Just don't put something *too* illegal on 

there. . . 


Sturm: 


Like what? 


SCHULTE: I'd be pretty pissed off if the FBI knocked 

on my door and said I had terrorist plans to 
nuke the US on my server. 

Sturm: Oh, well. It's all encrypted. So you could 

tell the FBI to STFU [shut the fuck up] 


SCHULTE: hahaaa. Yes, well. . encryptions can be 

broken. 


c. On or about March 12, 2009, SCHULTE, using 

username "Josh," communicated with username "Sturm" and username 
"hpb." During that conversation, SCHULTE, Sturm, and hpb 
appeared to discuss where to obtain child pornography. 
Specifically, at one point, SCHULTE asked the other individuals 
in the chat "[w]here does one get kiddie porn anyways?" SCHULTE 
subsequently posted an Internet address that, based on my 
training and experience, appeared to link to an image of child 
pornography. The address posted by SCHULTE included "images," 
"kiddie," and "porn." After posting the link, the following 
exchange occurred, in substance and in part: 


Sturm: 

It's interesting. Lalz. How is that even 
remotely arousing. 

SCHULTE: 

ughh idk 

Sturm: 

I thought kiddie porn was of like 15 year 
old girls. 

SCHULTE: 

yeah 

Sturm: 

But whatever floats your boat, I guess. . 

SCHULTE: 

I guess. . I mean, I guess they like it 
because the girls are pure? I dunno about 
why they'd like little boys? 

Sturm: 

Well, 15 year old girls are sexy. . But 
maybe that's because I'm 16. 
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SCHULTE: hmm I dunno if it's the looks they're 

attracted to or just the thought of them 
since they're probably virgins 

d. Later, on March 12, 2009, SCHULTE and Sturm 
discussed downloading child pornography from the Internet using 
a file sharing program called "Limewire" and viewing child 
pornography involving a five year old boy. Specifically, the 
following exchange occurred, in substance and in part: 

SCHULTE: Apparently limewire runs rampant with child 

porn. . They say "report it to the FBI", but 
will illegally download music. . damn now 
I'm interested. . . I might have to search 

it :P Type in "porn" and see what shows up 


[....] 

SCHULTE: You think I should search it? :P 

Sturm: Why not? 

SCHULTE: How do people get little kids to do porn 

anyway? Is it like 5 year olds? 

Sturm: They kidnap them I guess. Apparently there 

are like facebook and myspace child 
prostitution rings. 

SCHULTE: That one dude was into that like 5yr old boy 

hah really? 

Sturm: Yeah 

SCHULTE: oh you saw "Taken" right? 4 

Sturm: Yeah. That was some sick stuff. . 

SCHULTE: Like their sex business they have. That's 

kinda cool. 


4 I believe, based on my discussions with other law enforcement 
officers, and my training and experience, that SCHULTE's 
reference to "Taken" is to a movie in which teenage girls are 
kidnapped by human traffickers to be sold for sex. 
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e. On or about March 13, 2009, SCHULTE, using 

username "Josh," communicated with an individual using username 
"Sturm" and an individual using username "Niche." During that 
conversation, SCHULTE appeared to give Sturm and Niche access to 
his server to view potential child pornography and asked for 
their opinion on whether some of the participants appeared to be 
minors. Specifically, the following exchange occurred, in 
substance and in part: 


SCHULTE: It doesn't really look like kid porn to me. 

but idk [I don't know]. you guys decide :P 

Sturm: heh. . Lemme move to my workstation. . 

Niche: heh kk 


SCHULTE: 
Sturm: 
Niche: 
Sturm: 
Niche: 
Sturm: 

Niche: 
SCHULTE: 

Sturm: 
SCHULTE: 
Niche: 
SCHULTE: 


http://cryptm.org/~j osh/porn/ 

Wazzup ma homies 
lol 

I probably want to scp 5 this. . 

you have a whole folder for it?? 

Dude, scp it. You don't want to end up in 
jail. 

lol 

I'll take it down in a bit. Not like they 
will even know. 

What's the path? 

I don't see how they could tell. . 
heh 

/home/j osh/http/porn 


5 I believe, based on my discussions with other law enforcement 
officers, and my training and experience, that "scp" refers to a 
network protocol that supports secure file transfers to keep the 
data confidential while in transit. 
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Sturm: 

I dunno either, but I'm not taking the risk. 

. Which one should I watch first? 

Niche: 

hahaha 

Sturm: 

rename these things for god's sake. . 

SCHULTE: 

lol 

Niche: 

like it was a restaurant or some shit 

SCHULTE: 

alright. . hold up niche, I'm renaming 

Niche: 

oh fuck. . . I'll have to reopen the link. . 

SCHULTE: 

ok now try 

Sturm: 

Downloadin' "not kiddie pornl.mpg". 

SCHULTE: 

lol 


t- ■ • •] 


SCHULTE: 

dude it looks just like regular porn. . 

Sturm: 

I don't even like porn. . 

SCHULTE: 

you cant even tell they're underage. . if 
they even are. . . 


f. On or about June 28, 2009, SCHULTE, using 

username "Josh," communicated with username "Sturm" and others. 
During that conversation, SCHULTE appeared to discuss sharing an 
encrypted server with other individuals to distribute child 
pornography. Specifically, the following exchange occurred, in 
substance and in part: 


SCHULTE: 

Bleh, yall fools can host ye shit on the 
crypt. 

http://cryptm.org/~hpb/ 
http://cryptm.org/~dave/ 
http://cryptm.org/~niall/ 
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Niall: So what's the story with cryptm then 

Josh/Sturm? 


Sturm: Josh started it so he could securely host 

all his child/rape porn. 

SCHULTE: I got tired of my old server sucking back in 

Lubbock. Heh. . And, I hadn't built a 
computer in like, almost 6 months. .So, I 
build me a sweet server with 3TB, RAID, etc. 


Niall: Nice. Where is all the stuff up there then? 

Sturm: http://cryptm.org/data 


6. On or about March 13, 2017, pursuant to a search 
warrant authorized by the Honorable Barbara C. Moses, Google, 
Inc. produced information, including a history of JOSHUA ADAM 
SCHULTE, the defendant's, Google searches (the "Google 
Searches"). Based on my review of those Google Searches, I have 
learned, among other things, that on a number of occasions in or 
about 2011 and in or about 2012, SCHULTE appeared to search the 
Internet for child pornography. For example: (i) on or about 
April 9, 2011, SCHULTE conducted a Google Search for "child 
pornography" on at least three occasions; (ii) on or about 
October 15, 2011, SCHULTE conducted Google Searches for "movie 
where father videos daughter and friend sex" and "movie where 
father videos child porn"; and (iii) on or about May 15, 2012, 
SCHULTE conducted a Google Search for "female teenage body by 
year." 


7. On or about June 26, 2017, JOSHUA ADAM SCHULTE, 

the defendant, was interviewed in the presence of his attorneys 
(the "June 2017 Interview"). During the course of the June 2017 
Interview: 


a. SCHULTE identified a photograph of the 
Desktop Computer as his primary computer. He stated that he was 
the sole and exclusive user of the Desktop Computer and that he 
did not give anyone else access to the Desktop Computer. 

b. SCHULTE stated that he purchased the Desktop 
Computer himself while he was living in Virginia, and 
transported the Desktop- Computer from Virginia to New York in or 
about November 2016, when he moved. 
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c. SCHULTE stated that he used the Desktop 
Computer for various activities, including gaming and browsing 
the Internet. 


d. SCHULTE explained that he had personally 
installed encryption on the Desktop Computer. He stated that he 
did not share the password for the encrypted portions of the 
Desktop Computer with anyone else. 

e. SCHULTE was asked what he maintained inside 
the encrypted portions of the Desktop Computer. He responded 
that he used the encrypted portions of his Desktop Computer to 
store pornography. He further claimed that he encrypted it 
because he did not want his family to find it. When asked if he 
would be willing to provide investigators with the password to 
the encrypted portions of the Desktop Computer, he declined. 

f. SCHULTE also acknowledged that he maintained 
communications with others using the IRC Program, which he 
hosted on his Desktop Computer. SCHULTE stated that his own 
screen name on the IRC Program was "Josh." 

8. During the course of the June 2017 Interview, 
SCHULTE also stated that he was interested in the return of the 
computing devices seized during the course of the March 2017 
search of his Residence. Specifically, SCHULTE was principally 
interested in the return of his cellular telephone — on which 
the passwords to the encrypted portions of the Desktop Computer 
were found pursuant to the Cellphone Examination — and the 
return of his Desktop Computer — where the child pornography 
images were located in an encrypted container. 
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WHEREFORE deponent prays that a warrant be issued for the 
arrest of JOSHUA ADAM SCHULTE, the defendant, and that he be 
arrested and imprisoned, or bailed, as the case may be. 

I ijs, ^ _ 

Special Agent Je^ff David Donaldson 
Federal Bureau of Investigation 


Sworn to before me this 
23rd day of August, 2017 


THE 

UNITED STATES MAGISTRATE JUDGE 
SOUTHERN DISTRICT OF NEW YORK 


HONORABLE'HENRY PITMAN 
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